SUNRPC: Fix dentry refcounting issues with users of rpc_pipefs
[safe/jmp/linux-2.6] / fs / namespace.c
index 1487982..fa7ed6a 100644 (file)
@@ -8,7 +8,6 @@
  * Heavily rewritten.
  */
 
-#include <linux/config.h>
 #include <linux/syscalls.h>
 #include <linux/slab.h>
 #include <linux/sched.h>
@@ -16,6 +15,7 @@
 #include <linux/init.h>
 #include <linux/quotaops.h>
 #include <linux/acct.h>
+#include <linux/capability.h>
 #include <linux/module.h>
 #include <linux/seq_file.h>
 #include <linux/namespace.h>
@@ -42,11 +42,15 @@ __cacheline_aligned_in_smp DEFINE_SPINLOCK(vfsmount_lock);
 
 static int event;
 
-static struct list_head *mount_hashtable;
+static struct list_head *mount_hashtable __read_mostly;
 static int hash_mask __read_mostly, hash_bits __read_mostly;
-static kmem_cache_t *mnt_cache;
+static kmem_cache_t *mnt_cache __read_mostly;
 static struct rw_semaphore namespace_sem;
 
+/* /sys/fs */
+decl_subsys(fs, NULL, NULL);
+EXPORT_SYMBOL_GPL(fs_subsys);
+
 static inline unsigned long hash(struct vfsmount *mnt, struct dentry *dentry)
 {
        unsigned long tmp = ((unsigned long)mnt / L1_CACHE_BYTES);
@@ -67,6 +71,8 @@ struct vfsmount *alloc_vfsmnt(const char *name)
                INIT_LIST_HEAD(&mnt->mnt_list);
                INIT_LIST_HEAD(&mnt->mnt_expire);
                INIT_LIST_HEAD(&mnt->mnt_share);
+               INIT_LIST_HEAD(&mnt->mnt_slave_list);
+               INIT_LIST_HEAD(&mnt->mnt_slave);
                if (name) {
                        int size = strlen(name) + 1;
                        char *newname = kmalloc(size, GFP_KERNEL);
@@ -79,6 +85,15 @@ struct vfsmount *alloc_vfsmnt(const char *name)
        return mnt;
 }
 
+int simple_set_mnt(struct vfsmount *mnt, struct super_block *sb)
+{
+       mnt->mnt_sb = sb;
+       mnt->mnt_root = dget(sb->s_root);
+       return 0;
+}
+
+EXPORT_SYMBOL(simple_set_mnt);
+
 void free_vfsmnt(struct vfsmount *mnt)
 {
        kfree(mnt->mnt_devname);
@@ -86,31 +101,44 @@ void free_vfsmnt(struct vfsmount *mnt)
 }
 
 /*
- * Now, lookup_mnt increments the ref count before returning
- * the vfsmount struct.
+ * find the first or last mount at @dentry on vfsmount @mnt depending on
+ * @dir. If @dir is set return the first mount else return the last mount.
  */
-struct vfsmount *lookup_mnt(struct vfsmount *mnt, struct dentry *dentry)
+struct vfsmount *__lookup_mnt(struct vfsmount *mnt, struct dentry *dentry,
+                             int dir)
 {
        struct list_head *head = mount_hashtable + hash(mnt, dentry);
        struct list_head *tmp = head;
        struct vfsmount *p, *found = NULL;
 
-       spin_lock(&vfsmount_lock);
        for (;;) {
-               tmp = tmp->next;
+               tmp = dir ? tmp->next : tmp->prev;
                p = NULL;
                if (tmp == head)
                        break;
                p = list_entry(tmp, struct vfsmount, mnt_hash);
                if (p->mnt_parent == mnt && p->mnt_mountpoint == dentry) {
-                       found = mntget(p);
+                       found = p;
                        break;
                }
        }
-       spin_unlock(&vfsmount_lock);
        return found;
 }
 
+/*
+ * lookup_mnt increments the ref count before returning
+ * the vfsmount struct.
+ */
+struct vfsmount *lookup_mnt(struct vfsmount *mnt, struct dentry *dentry)
+{
+       struct vfsmount *child_mnt;
+       spin_lock(&vfsmount_lock);
+       if ((child_mnt = __lookup_mnt(mnt, dentry, 1)))
+               mntget(child_mnt);
+       spin_unlock(&vfsmount_lock);
+       return child_mnt;
+}
+
 static inline int check_mnt(struct vfsmount *mnt)
 {
        return mnt->mnt_namespace == current->namespace;
@@ -198,6 +226,16 @@ static struct vfsmount *next_mnt(struct vfsmount *p, struct vfsmount *root)
        return list_entry(next, struct vfsmount, mnt_child);
 }
 
+static struct vfsmount *skip_mnt_tree(struct vfsmount *p)
+{
+       struct list_head *prev = p->mnt_mounts.prev;
+       while (prev != &p->mnt_mounts) {
+               p = list_entry(prev, struct vfsmount, mnt_child);
+               prev = p->mnt_mounts.prev;
+       }
+       return p;
+}
+
 static struct vfsmount *clone_mnt(struct vfsmount *old, struct dentry *root,
                                        int flag)
 {
@@ -212,8 +250,17 @@ static struct vfsmount *clone_mnt(struct vfsmount *old, struct dentry *root,
                mnt->mnt_mountpoint = mnt->mnt_root;
                mnt->mnt_parent = mnt;
 
-               if ((flag & CL_PROPAGATION) || IS_MNT_SHARED(old))
-                       list_add(&mnt->mnt_share, &old->mnt_share);
+               if (flag & CL_SLAVE) {
+                       list_add(&mnt->mnt_slave, &old->mnt_slave_list);
+                       mnt->mnt_master = old;
+                       CLEAR_MNT_SHARED(mnt);
+               } else {
+                       if ((flag & CL_PROPAGATION) || IS_MNT_SHARED(old))
+                               list_add(&mnt->mnt_share, &old->mnt_share);
+                       if (IS_MNT_SLAVE(old))
+                               list_add(&mnt->mnt_slave, &old->mnt_slave);
+                       mnt->mnt_master = old->mnt_master;
+               }
                if (flag & CL_MAKE_SHARED)
                        set_mnt_shared(mnt);
 
@@ -321,14 +368,14 @@ static int show_vfsmnt(struct seq_file *m, void *v)
                { MS_SYNCHRONOUS, ",sync" },
                { MS_DIRSYNC, ",dirsync" },
                { MS_MANDLOCK, ",mand" },
-               { MS_NOATIME, ",noatime" },
-               { MS_NODIRATIME, ",nodiratime" },
                { 0, NULL }
        };
        static struct proc_fs_info mnt_info[] = {
                { MNT_NOSUID, ",nosuid" },
                { MNT_NODEV, ",nodev" },
                { MNT_NOEXEC, ",noexec" },
+               { MNT_NOATIME, ",noatime" },
+               { MNT_NODIRATIME, ",nodiratime" },
                { 0, NULL }
        };
        struct proc_fs_info *fs_infop;
@@ -360,6 +407,44 @@ struct seq_operations mounts_op = {
        .show   = show_vfsmnt
 };
 
+static int show_vfsstat(struct seq_file *m, void *v)
+{
+       struct vfsmount *mnt = v;
+       int err = 0;
+
+       /* device */
+       if (mnt->mnt_devname) {
+               seq_puts(m, "device ");
+               mangle(m, mnt->mnt_devname);
+       } else
+               seq_puts(m, "no device");
+
+       /* mount point */
+       seq_puts(m, " mounted on ");
+       seq_path(m, mnt, mnt->mnt_root, " \t\n\\");
+       seq_putc(m, ' ');
+
+       /* file system type */
+       seq_puts(m, "with fstype ");
+       mangle(m, mnt->mnt_sb->s_type->name);
+
+       /* optional statistics */
+       if (mnt->mnt_sb->s_op->show_stats) {
+               seq_putc(m, ' ');
+               err = mnt->mnt_sb->s_op->show_stats(m, mnt);
+       }
+
+       seq_putc(m, '\n');
+       return err;
+}
+
+struct seq_operations mountstats_op = {
+       .start  = m_start,
+       .next   = m_next,
+       .stop   = m_stop,
+       .show   = show_vfsstat,
+};
+
 /**
  * may_umount_tree - check if a mount tree is busy
  * @mnt: root of mount tree
@@ -382,9 +467,9 @@ int may_umount_tree(struct vfsmount *mnt)
        spin_unlock(&vfsmount_lock);
 
        if (actual_refs > minimum_refs)
-               return -EBUSY;
+               return 0;
 
-       return 0;
+       return 1;
 }
 
 EXPORT_SYMBOL(may_umount_tree);
@@ -404,9 +489,12 @@ EXPORT_SYMBOL(may_umount_tree);
  */
 int may_umount(struct vfsmount *mnt)
 {
-       if (atomic_read(&mnt->mnt_count) > 2)
-               return -EBUSY;
-       return 0;
+       int ret = 1;
+       spin_lock(&vfsmount_lock);
+       if (propagate_mount_busy(mnt, 2))
+               ret = 0;
+       spin_unlock(&vfsmount_lock);
+       return ret;
 }
 
 EXPORT_SYMBOL(may_umount);
@@ -414,7 +502,7 @@ EXPORT_SYMBOL(may_umount);
 void release_mounts(struct list_head *head)
 {
        struct vfsmount *mnt;
-       while(!list_empty(head)) {
+       while (!list_empty(head)) {
                mnt = list_entry(head->next, struct vfsmount, mnt_hash);
                list_del_init(&mnt->mnt_hash);
                if (mnt->mnt_parent != mnt) {
@@ -433,14 +521,15 @@ void release_mounts(struct list_head *head)
        }
 }
 
-void umount_tree(struct vfsmount *mnt, struct list_head *kill)
+void umount_tree(struct vfsmount *mnt, int propagate, struct list_head *kill)
 {
        struct vfsmount *p;
 
-       for (p = mnt; p; p = next_mnt(p, mnt)) {
-               list_del(&p->mnt_hash);
-               list_add(&p->mnt_hash, kill);
-       }
+       for (p = mnt; p; p = next_mnt(p, mnt))
+               list_move(&p->mnt_hash, kill);
+
+       if (propagate)
+               propagate_umount(kill);
 
        list_for_each_entry(p, kill, mnt_hash) {
                list_del_init(&p->mnt_expire);
@@ -449,7 +538,8 @@ void umount_tree(struct vfsmount *mnt, struct list_head *kill)
                p->mnt_namespace = NULL;
                list_del_init(&p->mnt_child);
                if (p->mnt_parent != p)
-                       mnt->mnt_mountpoint->d_mounted--;
+                       p->mnt_mountpoint->d_mounted--;
+               change_mnt_propagation(p, MS_PRIVATE);
        }
 }
 
@@ -492,8 +582,8 @@ static int do_umount(struct vfsmount *mnt, int flags)
         */
 
        lock_kernel();
-       if ((flags & MNT_FORCE) && sb->s_op->umount_begin)
-               sb->s_op->umount_begin(sb);
+       if (sb->s_op->umount_begin)
+               sb->s_op->umount_begin(mnt, flags);
        unlock_kernel();
 
        /*
@@ -526,9 +616,9 @@ static int do_umount(struct vfsmount *mnt, int flags)
        event++;
 
        retval = -EBUSY;
-       if (atomic_read(&mnt->mnt_count) == 2 || flags & MNT_DETACH) {
+       if (flags & MNT_DETACH || !propagate_mount_busy(mnt, 2)) {
                if (!list_empty(&mnt->mnt_list))
-                       umount_tree(mnt, &umount_list);
+                       umount_tree(mnt, 1, &umount_list);
                retval = 0;
        }
        spin_unlock(&vfsmount_lock);
@@ -596,7 +686,7 @@ static int mount_is_safe(struct nameidata *nd)
                if (current->uid != nd->dentry->d_inode->i_uid)
                        return -EPERM;
        }
-       if (permission(nd->dentry->d_inode, MAY_WRITE, nd))
+       if (vfs_permission(nd, MAY_WRITE))
                return -EPERM;
        return 0;
 #endif
@@ -619,6 +709,9 @@ struct vfsmount *copy_tree(struct vfsmount *mnt, struct dentry *dentry,
        struct vfsmount *res, *p, *q, *r, *s;
        struct nameidata nd;
 
+       if (!(flag & CL_COPY_ALL) && IS_MNT_UNBINDABLE(mnt))
+               return NULL;
+
        res = q = clone_mnt(mnt, dentry, flag);
        if (!q)
                goto Enomem;
@@ -630,6 +723,10 @@ struct vfsmount *copy_tree(struct vfsmount *mnt, struct dentry *dentry,
                        continue;
 
                for (s = r; s; s = next_mnt(s, r)) {
+                       if (!(flag & CL_COPY_ALL) && IS_MNT_UNBINDABLE(s)) {
+                               s = skip_mnt_tree(s);
+                               continue;
+                       }
                        while (p != s->mnt_parent) {
                                p = p->mnt_parent;
                                q = q->mnt_parent;
@@ -651,7 +748,7 @@ Enomem:
        if (res) {
                LIST_HEAD(umount_list);
                spin_lock(&vfsmount_lock);
-               umount_tree(res, &umount_list);
+               umount_tree(res, 0, &umount_list);
                spin_unlock(&vfsmount_lock);
                release_mounts(&umount_list);
        }
@@ -667,18 +764,18 @@ Enomem:
  *
  *  NOTE: in the table below explains the semantics when a source mount
  *  of a given type is attached to a destination mount of a given type.
- *     ---------------------------------------------
- *     |         BIND MOUNT OPERATION              |
- *     |********************************************
- *     | source-->| shared        |       private  |
- *     | dest     |               |                |
- *     |   |      |               |                |
- *     |   v      |               |                |
- *     |********************************************
- *     |  shared  | shared (++)   |     shared (+) |
- *     |          |               |                |
- *     |non-shared| shared (+)    |      private   |
- *     *********************************************
+ * ---------------------------------------------------------------------------
+ * |         BIND MOUNT OPERATION                                            |
+ * |**************************************************************************
+ * | source-->| shared        |       private  |       slave    | unbindable |
+ * | dest     |               |                |                |            |
+ * |   |      |               |                |                |            |
+ * |   v      |               |                |                |            |
+ * |**************************************************************************
+ * |  shared  | shared (++)   |     shared (+) |     shared(+++)|  invalid   |
+ * |          |               |                |                |            |
+ * |non-shared| shared (+)    |      private   |      slave (*) |  invalid   |
+ * ***************************************************************************
  * A bind operation clones the source mount and mounts the clone on the
  * destination mount.
  *
@@ -688,21 +785,33 @@ Enomem:
  * (+)   the cloned mount is created under the destination mount and is marked
  *       as shared. The cloned mount is added to the peer group of the source
  *       mount.
- *     ---------------------------------------------
- *     |               MOVE MOUNT OPERATION        |
- *     |********************************************
- *     | source-->| shared        |       private  |
- *     | dest     |               |                |
- *     |   |      |               |                |
- *     |   v      |               |                |
- *     |********************************************
- *     |  shared  | shared (+)    |     shared (+) |
- *     |          |               |                |
- *     |non-shared| shared (+*)   |      private   |
- *     *********************************************
- * (+)  the mount is moved to the destination. And is then propagated to all
- *     the mounts in the propagation tree of the destination mount.
+ * (+++) the mount is propagated to all the mounts in the propagation tree
+ *       of the destination mount and the cloned mount is made slave
+ *       of the same master as that of the source mount. The cloned mount
+ *       is marked as 'shared and slave'.
+ * (*)   the cloned mount is made a slave of the same master as that of the
+ *      source mount.
+ *
+ * ---------------------------------------------------------------------------
+ * |                   MOVE MOUNT OPERATION                                 |
+ * |**************************************************************************
+ * | source-->| shared        |       private  |       slave    | unbindable |
+ * | dest     |               |                |                |            |
+ * |   |      |               |                |                |            |
+ * |   v      |               |                |                |            |
+ * |**************************************************************************
+ * |  shared  | shared (+)    |     shared (+) |    shared(+++) |  invalid   |
+ * |          |               |                |                |            |
+ * |non-shared| shared (+*)   |      private   |    slave (*)   | unbindable |
+ * ***************************************************************************
+ *
+ * (+)  the mount is moved to the destination. And is then propagated to
+ *     all the mounts in the propagation tree of the destination mount.
  * (+*)  the mount is moved to the destination.
+ * (+++)  the mount is moved to the destination and is then propagated to
+ *     all the mounts belonging to the destination mount's propagation tree.
+ *     the mount is marked as 'shared and slave'.
+ * (*) the mount continues to be a slave at the new location.
  *
  * if the source mount is a tree, the operations explained above is
  * applied to each mount in the tree.
@@ -754,7 +863,7 @@ static int graft_tree(struct vfsmount *mnt, struct nameidata *nd)
                return -ENOTDIR;
 
        err = -ENOENT;
-       down(&nd->dentry->d_inode->i_sem);
+       mutex_lock(&nd->dentry->d_inode->i_mutex);
        if (IS_DEADDIR(nd->dentry->d_inode))
                goto out_unlock;
 
@@ -766,7 +875,7 @@ static int graft_tree(struct vfsmount *mnt, struct nameidata *nd)
        if (IS_ROOT(nd->dentry) || !d_unhashed(nd->dentry))
                err = attach_recursive_mnt(mnt, nd, NULL);
 out_unlock:
-       up(&nd->dentry->d_inode->i_sem);
+       mutex_unlock(&nd->dentry->d_inode->i_mutex);
        if (!err)
                security_sb_post_addmount(mnt, nd);
        return err;
@@ -811,6 +920,9 @@ static int do_loopback(struct nameidata *nd, char *old_name, int recurse)
 
        down_write(&namespace_sem);
        err = -EINVAL;
+       if (IS_MNT_UNBINDABLE(old_nd.mnt))
+               goto out;
+
        if (!check_mnt(nd->mnt) || !check_mnt(old_nd.mnt))
                goto out;
 
@@ -827,7 +939,7 @@ static int do_loopback(struct nameidata *nd, char *old_name, int recurse)
        if (err) {
                LIST_HEAD(umount_list);
                spin_lock(&vfsmount_lock);
-               umount_tree(mnt, &umount_list);
+               umount_tree(mnt, 0, &umount_list);
                spin_unlock(&vfsmount_lock);
                release_mounts(&umount_list);
        }
@@ -868,6 +980,16 @@ static int do_remount(struct nameidata *nd, int flags, int mnt_flags,
        return err;
 }
 
+static inline int tree_contains_unbindable(struct vfsmount *mnt)
+{
+       struct vfsmount *p;
+       for (p = mnt; p; p = next_mnt(p, mnt)) {
+               if (IS_MNT_UNBINDABLE(p))
+                       return 1;
+       }
+       return 0;
+}
+
 static int do_move_mount(struct nameidata *nd, char *old_name)
 {
        struct nameidata old_nd, parent_nd;
@@ -889,7 +1011,7 @@ static int do_move_mount(struct nameidata *nd, char *old_name)
                goto out;
 
        err = -ENOENT;
-       down(&nd->dentry->d_inode->i_sem);
+       mutex_lock(&nd->dentry->d_inode->i_mutex);
        if (IS_DEADDIR(nd->dentry->d_inode))
                goto out1;
 
@@ -911,6 +1033,12 @@ static int do_move_mount(struct nameidata *nd, char *old_name)
         */
        if (old_nd.mnt->mnt_parent && IS_MNT_SHARED(old_nd.mnt->mnt_parent))
                goto out1;
+       /*
+        * Don't move a mount tree containing unbindable mounts to a destination
+        * mount which is shared.
+        */
+       if (IS_MNT_SHARED(nd->mnt) && tree_contains_unbindable(old_nd.mnt))
+               goto out1;
        err = -ELOOP;
        for (p = nd->mnt; p->mnt_parent != p; p = p->mnt_parent)
                if (p == old_nd.mnt)
@@ -925,7 +1053,7 @@ static int do_move_mount(struct nameidata *nd, char *old_name)
        list_del_init(&old_nd.mnt->mnt_expire);
        spin_unlock(&vfsmount_lock);
 out1:
-       up(&nd->dentry->d_inode->i_sem);
+       mutex_unlock(&nd->dentry->d_inode->i_mutex);
 out:
        up_write(&namespace_sem);
        if (!err)
@@ -1023,12 +1151,12 @@ static void expire_mount(struct vfsmount *mnt, struct list_head *mounts,
         * Check that it is still dead: the count should now be 2 - as
         * contributed by the vfsmount parent and the mntget above
         */
-       if (atomic_read(&mnt->mnt_count) == 2) {
+       if (!propagate_mount_busy(mnt, 2)) {
                /* delete from the namespace */
                touch_namespace(mnt->mnt_namespace);
                list_del_init(&mnt->mnt_list);
                mnt->mnt_namespace = NULL;
-               umount_tree(mnt, umounts);
+               umount_tree(mnt, 1, umounts);
                spin_unlock(&vfsmount_lock);
        } else {
                /*
@@ -1041,13 +1169,46 @@ static void expire_mount(struct vfsmount *mnt, struct list_head *mounts,
 }
 
 /*
+ * go through the vfsmounts we've just consigned to the graveyard to
+ * - check that they're still dead
+ * - delete the vfsmount from the appropriate namespace under lock
+ * - dispose of the corpse
+ */
+static void expire_mount_list(struct list_head *graveyard, struct list_head *mounts)
+{
+       struct namespace *namespace;
+       struct vfsmount *mnt;
+
+       while (!list_empty(graveyard)) {
+               LIST_HEAD(umounts);
+               mnt = list_entry(graveyard->next, struct vfsmount, mnt_expire);
+               list_del_init(&mnt->mnt_expire);
+
+               /* don't do anything if the namespace is dead - all the
+                * vfsmounts from it are going away anyway */
+               namespace = mnt->mnt_namespace;
+               if (!namespace || !namespace->root)
+                       continue;
+               get_namespace(namespace);
+
+               spin_unlock(&vfsmount_lock);
+               down_write(&namespace_sem);
+               expire_mount(mnt, mounts, &umounts);
+               up_write(&namespace_sem);
+               release_mounts(&umounts);
+               mntput(mnt);
+               put_namespace(namespace);
+               spin_lock(&vfsmount_lock);
+       }
+}
+
+/*
  * process a list of expirable mountpoints with the intent of discarding any
  * mountpoints that aren't in use and haven't been touched since last we came
  * here
  */
 void mark_mounts_for_expiry(struct list_head *mounts)
 {
-       struct namespace *namespace;
        struct vfsmount *mnt, *next;
        LIST_HEAD(graveyard);
 
@@ -1071,38 +1232,79 @@ void mark_mounts_for_expiry(struct list_head *mounts)
                list_move(&mnt->mnt_expire, &graveyard);
        }
 
-       /*
-        * go through the vfsmounts we've just consigned to the graveyard to
-        * - check that they're still dead
-        * - delete the vfsmount from the appropriate namespace under lock
-        * - dispose of the corpse
-        */
-       while (!list_empty(&graveyard)) {
-               LIST_HEAD(umounts);
-               mnt = list_entry(graveyard.next, struct vfsmount, mnt_expire);
-               list_del_init(&mnt->mnt_expire);
+       expire_mount_list(&graveyard, mounts);
 
-               /* don't do anything if the namespace is dead - all the
-                * vfsmounts from it are going away anyway */
-               namespace = mnt->mnt_namespace;
-               if (!namespace || !namespace->root)
+       spin_unlock(&vfsmount_lock);
+}
+
+EXPORT_SYMBOL_GPL(mark_mounts_for_expiry);
+
+/*
+ * Ripoff of 'select_parent()'
+ *
+ * search the list of submounts for a given mountpoint, and move any
+ * shrinkable submounts to the 'graveyard' list.
+ */
+static int select_submounts(struct vfsmount *parent, struct list_head *graveyard)
+{
+       struct vfsmount *this_parent = parent;
+       struct list_head *next;
+       int found = 0;
+
+repeat:
+       next = this_parent->mnt_mounts.next;
+resume:
+       while (next != &this_parent->mnt_mounts) {
+               struct list_head *tmp = next;
+               struct vfsmount *mnt = list_entry(tmp, struct vfsmount, mnt_child);
+
+               next = tmp->next;
+               if (!(mnt->mnt_flags & MNT_SHRINKABLE))
                        continue;
-               get_namespace(namespace);
+               /*
+                * Descend a level if the d_mounts list is non-empty.
+                */
+               if (!list_empty(&mnt->mnt_mounts)) {
+                       this_parent = mnt;
+                       goto repeat;
+               }
 
-               spin_unlock(&vfsmount_lock);
-               down_write(&namespace_sem);
-               expire_mount(mnt, mounts, &umounts);
-               up_write(&namespace_sem);
-               release_mounts(&umounts);
-               mntput(mnt);
-               put_namespace(namespace);
-               spin_lock(&vfsmount_lock);
+               if (!propagate_mount_busy(mnt, 1)) {
+                       mntget(mnt);
+                       list_move_tail(&mnt->mnt_expire, graveyard);
+                       found++;
+               }
+       }
+       /*
+        * All done at this level ... ascend and resume the search
+        */
+       if (this_parent != parent) {
+               next = this_parent->mnt_child.next;
+               this_parent = this_parent->mnt_parent;
+               goto resume;
        }
+       return found;
+}
+
+/*
+ * process a list of expirable mountpoints with the intent of discarding any
+ * submounts of a specific parent mountpoint
+ */
+void shrink_submounts(struct vfsmount *mountpoint, struct list_head *mounts)
+{
+       LIST_HEAD(graveyard);
+       int found;
+
+       spin_lock(&vfsmount_lock);
+
+       /* extract submounts of 'mountpoint' from the expiration list */
+       while ((found = select_submounts(mountpoint, &graveyard)) != 0)
+               expire_mount_list(&graveyard, mounts);
 
        spin_unlock(&vfsmount_lock);
 }
 
-EXPORT_SYMBOL_GPL(mark_mounts_for_expiry);
+EXPORT_SYMBOL_GPL(shrink_submounts);
 
 /*
  * Some copy_from_user() implementations do not return the exact number of
@@ -1207,7 +1409,13 @@ long do_mount(char *dev_name, char *dir_name, char *type_page,
                mnt_flags |= MNT_NODEV;
        if (flags & MS_NOEXEC)
                mnt_flags |= MNT_NOEXEC;
-       flags &= ~(MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_ACTIVE);
+       if (flags & MS_NOATIME)
+               mnt_flags |= MNT_NOATIME;
+       if (flags & MS_NODIRATIME)
+               mnt_flags |= MNT_NODIRATIME;
+
+       flags &= ~(MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_ACTIVE |
+                  MS_NOATIME | MS_NODIRATIME);
 
        /* ... and get the mountpoint */
        retval = path_lookup(dir_name, LOOKUP_FOLLOW, &nd);
@@ -1223,7 +1431,7 @@ long do_mount(char *dev_name, char *dir_name, char *type_page,
                                    data_page);
        else if (flags & MS_BIND)
                retval = do_loopback(&nd, dev_name, flags & MS_REC);
-       else if (flags & (MS_SHARED | MS_PRIVATE))
+       else if (flags & (MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE))
                retval = do_change_type(&nd, flags);
        else if (flags & MS_MOVE)
                retval = do_move_mount(&nd, dev_name);
@@ -1235,30 +1443,20 @@ dput_out:
        return retval;
 }
 
-int copy_namespace(int flags, struct task_struct *tsk)
+/*
+ * Allocate a new namespace structure and populate it with contents
+ * copied from the namespace of the passed in task structure.
+ */
+struct namespace *dup_namespace(struct task_struct *tsk, struct fs_struct *fs)
 {
        struct namespace *namespace = tsk->namespace;
        struct namespace *new_ns;
        struct vfsmount *rootmnt = NULL, *pwdmnt = NULL, *altrootmnt = NULL;
-       struct fs_struct *fs = tsk->fs;
        struct vfsmount *p, *q;
 
-       if (!namespace)
-               return 0;
-
-       get_namespace(namespace);
-
-       if (!(flags & CLONE_NEWNS))
-               return 0;
-
-       if (!capable(CAP_SYS_ADMIN)) {
-               put_namespace(namespace);
-               return -EPERM;
-       }
-
        new_ns = kmalloc(sizeof(struct namespace), GFP_KERNEL);
        if (!new_ns)
-               goto out;
+               return NULL;
 
        atomic_set(&new_ns->count, 1);
        INIT_LIST_HEAD(&new_ns->list);
@@ -1268,11 +1466,11 @@ int copy_namespace(int flags, struct task_struct *tsk)
        down_write(&namespace_sem);
        /* First pass: copy the tree topology */
        new_ns->root = copy_tree(namespace->root, namespace->root->mnt_root,
-                                       CL_EXPIRE);
+                                       CL_COPY_ALL | CL_EXPIRE);
        if (!new_ns->root) {
                up_write(&namespace_sem);
                kfree(new_ns);
-               goto out;
+               return NULL;
        }
        spin_lock(&vfsmount_lock);
        list_add_tail(&new_ns->list, &new_ns->root->mnt_list);
@@ -1306,8 +1504,6 @@ int copy_namespace(int flags, struct task_struct *tsk)
        }
        up_write(&namespace_sem);
 
-       tsk->namespace = new_ns;
-
        if (rootmnt)
                mntput(rootmnt);
        if (pwdmnt)
@@ -1315,12 +1511,39 @@ int copy_namespace(int flags, struct task_struct *tsk)
        if (altrootmnt)
                mntput(altrootmnt);
 
-       put_namespace(namespace);
-       return 0;
+       return new_ns;
+}
+
+int copy_namespace(int flags, struct task_struct *tsk)
+{
+       struct namespace *namespace = tsk->namespace;
+       struct namespace *new_ns;
+       int err = 0;
+
+       if (!namespace)
+               return 0;
+
+       get_namespace(namespace);
+
+       if (!(flags & CLONE_NEWNS))
+               return 0;
+
+       if (!capable(CAP_SYS_ADMIN)) {
+               err = -EPERM;
+               goto out;
+       }
+
+       new_ns = dup_namespace(tsk, tsk->fs);
+       if (!new_ns) {
+               err = -ENOMEM;
+               goto out;
+       }
+
+       tsk->namespace = new_ns;
 
 out:
        put_namespace(namespace);
-       return -ENOMEM;
+       return err;
 }
 
 asmlinkage long sys_mount(char __user * dev_name, char __user * dir_name,
@@ -1447,6 +1670,10 @@ static void chroot_fs_refs(struct nameidata *old_nd, struct nameidata *new_nd)
  * pointed to by put_old must yield the same directory as new_root. No other
  * file system may be mounted on put_old. After all, new_root is a mountpoint.
  *
+ * Also, the current root cannot be on the 'rootfs' (initial ramfs) filesystem.
+ * See Documentation/filesystems/ramfs-rootfs-initramfs.txt for alternatives
+ * in this situation.
+ *
  * Notes:
  *  - we don't move root/cwd if they are not at the root (reason: if something
  *    cared enough to change them, it's probably wrong to force them elsewhere)
@@ -1490,7 +1717,7 @@ asmlinkage long sys_pivot_root(const char __user * new_root,
        user_nd.dentry = dget(current->fs->root);
        read_unlock(&current->fs->lock);
        down_write(&namespace_sem);
-       down(&old_nd.dentry->d_inode->i_sem);
+       mutex_lock(&old_nd.dentry->d_inode->i_mutex);
        error = -EINVAL;
        if (IS_MNT_SHARED(old_nd.mnt) ||
                IS_MNT_SHARED(new_nd.mnt->mnt_parent) ||
@@ -1543,7 +1770,7 @@ asmlinkage long sys_pivot_root(const char __user * new_root,
        path_release(&root_parent);
        path_release(&parent_nd);
 out2:
-       up(&old_nd.dentry->d_inode->i_sem);
+       mutex_unlock(&old_nd.dentry->d_inode->i_mutex);
        up_write(&namespace_sem);
        path_release(&user_nd);
        path_release(&old_nd);
@@ -1635,6 +1862,7 @@ void __init mnt_init(unsigned long mempages)
                i--;
        } while (i);
        sysfs_init();
+       subsystem_register(&fs_subsys);
        init_rootfs();
        init_mount_tree();
 }
@@ -1647,7 +1875,7 @@ void __put_namespace(struct namespace *namespace)
        spin_unlock(&vfsmount_lock);
        down_write(&namespace_sem);
        spin_lock(&vfsmount_lock);
-       umount_tree(root, &umount_list);
+       umount_tree(root, 0, &umount_list);
        spin_unlock(&vfsmount_lock);
        up_write(&namespace_sem);
        release_mounts(&umount_list);